Microsoft Office 365 Attacks Sparked from Google Firebase

[upnorth]

Content source

https://threatpost.com/microsoft-office-365-attacks-google-firebase/163666/

A phishing campaign bent on stealing Microsoft login credentials is using Google Firebase to bypass email security measures in Microsoft Office 365, researchers said.

Researchers at Armorblox uncovered invoice-themed emails sent to at least 20,000 mailboxes that purport to share information about an electronic funds transfer (EFT) payment. The emails carry a fairly vanilla subject line, “TRANSFER OF PAYMENT NOTICE FOR INVOICE,” and contain a link to download an “invoice” from the cloud. Clicking that link begins a series of redirects that eventually takes targets to a page with Microsoft Office branding that’s hosted on Google Firebase. That page is of course a phishing page, bent on harvesting Microsoft log-in information, secondary email addresses and phone numbers.

“This email attack bypassed native Microsoft email security controls,” the researcher noted. “Microsoft assigned a Spam Confidence Level (SCL) of ‘1’ to this email, which meant that Microsoft did not determine the email as suspicious and delivered it to end-user mailboxes.” For one thing, the redirect flow is complex, which helps mask the malicious nature of the messages, according to Upadhyaya, who noted that this kind of obfuscation is a common tactic to thwart security defenses that check for fake login pages.

Microsoft Office 365 Attacks Sparked from Google Firebase

A savvy phishing campaign manages to evade native Microsoft security defenses, looking to steal O365 credentials.

threatpost.com

More on Firebase attacks also here :

This Android malware claims to give hackers full control of your smartphone

Researchers detail Rogue RAT, which provides even low-level cyber criminals with the ability to read your messages, steal your passwords and even record your calls. A new combination of two older types of malware, which provides hackers with access to almost everything a user does on an Android...

malwaretips.com